Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls and SP 800-53A Rev 5.2.0 Assessment Procedures — Viewer

Support the management of system accounts using {{ insert: param, ac-02.01_odp }}.

Automatically {{ insert: param, ac-02.02_odp.01 }} temporary and emergency accounts after {{ insert: param, ac-02.02_odp.02 }}.

Disable accounts within {{ insert: param, ac-02.03_odp.01 }} when the accounts:

Automatically audit account creation, modification, enabling, disabling, and removal actions.

Require that users log out when {{ insert: param, ac-02.05_odp }}.

Implement {{ insert: param, ac-02.06_odp }}.

Create, activate, manage, and deactivate {{ insert: param, ac-02.08_odp }} dynamically.

Only permit the use of shared and group accounts that meet {{ insert: param, ac-02.09_odp }}.

Enforce {{ insert: param, ac-02.11_odp.01 }} for {{ insert: param, ac-02.11_odp.02 }}.

Disable accounts of individuals within {{ insert: param, ac-02.13_odp.01 }} of discovery of {{ insert: param, ac-02.13_odp.02 }}.

Enforce dual authorization for {{ insert: param, ac-03.02_odp }}.

Enforce {{ insert: param, ac-3.3_prm_1 }} over the set of covered subjects and objects specified in the policy, and where the policy:

Enforce {{ insert: param, ac-3.4_prm_1 }} over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:

Prevent access to {{ insert: param, ac-03.05_odp }} except during secure, non-operable system states.

Enforce a role-based access control policy over defined subjects and objects and control access based upon {{ insert: param, ac-3.7_prm_1 }}.

Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on {{ insert: param, ac-03.08_odp }}.

Release information outside of the system only if:

Employ an audited override of automated access control mechanisms under {{ insert: param, ac-03.10_odp.01 }} by {{ insert: param, ac-03.10_odp.02 }}.

Restrict access to data repositories containing {{ insert: param, ac-03.11_odp }}.

Enforce attribute-based access control policy over defined subjects and objects and control access based upon {{ insert: param, ac-03.13_odp }}.

Provide {{ insert: param, ac-03.14_odp.01 }} to enable individuals to have access to the following elements of their personally identifiable information: {{ insert: param, ac-03.14_odp.02 }}.

Use {{ insert: param, ac-4.1_prm_1 }} associated with {{ insert: param, ac-4.1_prm_2 }} to enforce {{ insert: param, ac-04.01_odp.09 }} as a basis for flow control decisions.

Use protected processing domains to enforce {{ insert: param, ac-04.02_odp }} as a basis for flow control decisions.

Enforce {{ insert: param, ac-04.03_odp }}.

Prevent encrypted information from bypassing {{ insert: param, ac-04.04_odp.01 }} by {{ insert: param, ac-04.04_odp.02 }}.

Enforce {{ insert: param, ac-04.05_odp }} on embedding data types within other data types.

Enforce information flow control based on {{ insert: param, ac-04.06_odp }}.

Enforce one-way information flows through hardware-based flow control mechanisms.

Enforce the use of human reviews for {{ insert: param, ac-04.09_odp.01 }} under the following conditions: {{ insert: param, ac-04.09_odp.02 }}.

Provide the capability for privileged administrators to enable and disable {{ insert: param, ac-4.10_prm_1 }} under the following conditions: {{ insert: param, ac-4.10_prm_2 }}.

Provide the capability for privileged administrators to configure {{ insert: param, ac-4.11_prm_1 }} to support different security or privacy policies.

When transferring information between different security domains, use {{ insert: param, ac-04.12_odp }} to validate data essential for information flow decisions.

When transferring information between different security domains, decompose information into {{ insert: param, ac-04.13_odp }} for submission to policy enforcement mechanisms.

When transferring information between different security domains, implement {{ insert: param, ac-4.14_prm_1 }} requiring fully enumerated formats that restrict data structure and content.

When transferring information between different security domains, examine the information for the presence of {{ insert: param, ac-04.15_odp.01 }} and prohibit the transfer of such information in accordance with the {{ insert: param, ac-4.15_prm_2 }}.

Uniquely identify and authenticate source and destination points by {{ insert: param, ac-04.17_odp }} for information transfer.

When transferring information between different security domains, implement {{ insert: param, ac-4.19_prm_1 }} on metadata.

Employ {{ insert: param, ac-04.20_odp.01 }} to control the flow of {{ insert: param, ac-04.20_odp.02 }} across security domains.

Separate information flows logically or physically using {{ insert: param, ac-4.21_prm_1 }} to accomplish {{ insert: param, ac-04.21_odp.03 }}.

Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.

When transferring information between different security domains, modify non-releasable information by implementing {{ insert: param, ac-04.23_odp }}.

When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.

When transferring information between different security domains, sanitize data to minimize {{ insert: param, ac-04.25_odp.01 }} in accordance with {{ insert: param, ac-04.25_odp.02 }}.

When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.

When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.

When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.

When transferring information between different security domains, employ content filter orchestration engines to ensure that:

When transferring information between different security domains, implement content filtering mechanisms using multiple processes.

When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.

When transferring information between different security domains, the process that transfers information between filter pipelines:

Authorize access for {{ insert: param, ac-06.01_odp.01 }} to:

Require that users of system accounts (or roles) with access to {{ insert: param, ac-06.02_odp }} use non-privileged accounts or roles, when accessing nonsecurity functions.

Authorize network access to {{ insert: param, ac-06.03_odp.01 }} only for {{ insert: param, ac-06.03_odp.02 }} and document the rationale for such access in the security plan for the system.

Provide separate processing domains to enable finer-grained allocation of user privileges.

Restrict privileged accounts on the system to {{ insert: param, ac-06.05_odp }}.

Prohibit privileged access to the system by non-organizational users.

Prevent the following software from executing at higher privilege levels than users executing the software: {{ insert: param, ac-06.08_odp }}.

Log the execution of privileged functions.

Prevent non-privileged users from executing privileged functions.

Purge or wipe information from {{ insert: param, ac-07.02_odp.01 }} based on {{ insert: param, ac-07.02_odp.02 }} after {{ insert: param, ac-07.02_odp.03 }} consecutive, unsuccessful device logon attempts.

Limit the number of unsuccessful biometric logon attempts to {{ insert: param, ac-07.03_odp }}.

Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.

Notify the user, upon successful logon, of the number of {{ insert: param, ac-09.02_odp.01 }} during {{ insert: param, ac-09.02_odp.02 }}.

Notify the user, upon successful logon, of changes to {{ insert: param, ac-09.03_odp.01 }} during {{ insert: param, ac-09.03_odp.02 }}.

Notify the user, upon successful logon, of the following additional information: {{ insert: param, ac-09.04_odp }}.

Conceal, via the device lock, information previously visible on the display with a publicly viewable image.

Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to {{ insert: param, ac-12.01_odp }}.

Display an explicit logout message to users indicating the termination of authenticated communications sessions.

Display an explicit message to users indicating that the session will end in {{ insert: param, ac-12.03_odp }}.